sality | 0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Downloads MZ/PE file

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\hvm.sys	setup.exe
File opened for modification	C:\Windows\system32\drivers\HookTdi.sys	setup.exe
File created	C:\Windows\system32\drivers\HookTdi.sys	setup.exe
File opened for modification	C:\Windows\system32\drivers\HookHelp.sys	setup.exe
File created	C:\Windows\system32\drivers\HookHelp.sys	setup.exe
File opened for modification	C:\Windows\system32\drivers\Hooksys.sys	setup.exe
File created	C:\Windows\system32\drivers\Hooksys.sys	setup.exe
File opened for modification	C:\Windows\system32\drivers\hvm.sys	setup.exe

Executes dropped EXE 9 IoCs

pid	Process
276	1103948b.exe
1604	Rising.dat
964	setup.exe
532	CheckOld.exe
1620	LangSel.exe
1596	RsMgrSvc.exe
1740	popwndexe.exe
1924	RavMonD.exe
852	RavMonD.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\InprocServer32\ = "C:\\Windows\\system32\\RavExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1508-55-0x0000000001EE0000-0x0000000002F6E000-memory.dmp	upx
behavioral1/memory/1508-57-0x0000000001EE0000-0x0000000002F6E000-memory.dmp	upx
behavioral1/memory/1508-60-0x0000000001EE0000-0x0000000002F6E000-memory.dmp	upx
behavioral1/memory/276-70-0x0000000003000000-0x0000000003074000-memory.dmp	upx

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000002000620073006d00610069006e0000000000	setup.exe

Loads dropped DLL 64 IoCs

pid	Process
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
276	1103948b.exe
276	1103948b.exe
276	1103948b.exe
276	1103948b.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
1596	RsMgrSvc.exe
1596	RsMgrSvc.exe
964	setup.exe
1740	popwndexe.exe
1740	popwndexe.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe
964	setup.exe

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RSDTRAY = "\"C:\\Program Files (x86)\\Rising\\RSD\\popwndexe.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RavTRAY = "\"C:\\Program Files (x86)\\Rising\\RAV\\RSTRAY.EXE\" -system"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RavDown = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1103948b.exe\" /session F471A1F9B1A14944955ECC86A43CE745 /subkey RAV"	1103948b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\RavBin\DESKTOP.INI	setup.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\Z:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\J:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\M:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\P:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\V:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\W:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\X:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\Y:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\G:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\H:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\I:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\N:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\T:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\R:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\S:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\U:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\E:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\F:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\K:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\L:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
File opened (read-only)	\??\O:	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvcr71.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\MFC71.dll	setup.exe
File created	C:\Windows\SysWOW64\MFC71.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\bsmain.exe	setup.exe
File opened for modification	C:\Windows\SysWOW64\BsMain.ini	setup.exe
File opened for modification	C:\Windows\SysWOW64\msvcp71.dll	setup.exe
File created	C:\Windows\SysWOW64\msvcp71.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\ravext.dll	setup.exe
File created	C:\Windows\SysWOW64\ravext.dll	setup.exe
File opened for modification	C:\Windows\system32\RavExt64.dll	setup.exe
File created	C:\Windows\system32\RavExt64.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\msvcr71.dll	setup.exe
File created	C:\Windows\SysWOW64\bsmain.exe	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RsMgrSvc.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin2\images\closebtn.png	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin2\css\mini.css	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\scripts\jquery.js	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\pages\950\exit.htm	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\MonComm.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\pearc.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin2\images\mini\mask2.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\skin2\images\popup\green\tclose.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\common\images\tree\keyarea.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\pages\1252\tmiproty.htm	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Regguide\CaOK0950.htm	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVGUIDE\Regguide\imags\bt-018.gif	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSSKIN2\Skin\skin2\sliderbr.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\skin2\images\accemon2.png	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin2\images\scanfin.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVGUIDE\Regguide\imags\bg-023.gif	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVGUIDE\Regguide\imags\rb_br.gif	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\ur029.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Regguide\imags\bg-025.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Regguide\imags\bt-452.gif	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin2\images\popup\green\tfoot.png	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin1\images\popup\red\ttitle.png	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\common\images\tree\elbowem.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSENGINE\ExtOLE.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVLANG2\language\cht.la0	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\skin2\css\about.css	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\Regguide\imags\bt-018.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\scripts\tips.js	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\pages\950\tmaldef.htm	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVTRAY\UsbServ.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\skin2\images\secchkbg.png	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\UI\skins\skin2\images\tflash2.png	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\UI\pages\936\tfiproty.htm	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Regguide\imags\bg-028.gif	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMSG\Skin\PopSkin\rtnof.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSSKIN2\Skin\skin2\add.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Skin\skin2\rslogvw.bmp	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\common\images\tree\movable.gif	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\pages\936\rexp.htm	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVGUIDE\Regguide\Expr1252.htm	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSSKIN2\Skin\skin2\look.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSSKIN2\Skin\skin2\MenuIcon.png	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\mc.dll	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\Skin\skin2\fix2.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Skin\skin2\Spin.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin1\images\closebtn.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVGUIDE\Regguide\imags\bt-027.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\skin2\images\menuico.gif	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\Regguide\imags\bg-002.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Setup.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\skins\skin2\images\popup\green\tfootrca.png	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\UI\skins\skin1\images\scanfin2.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\pages\936\rexp.htm	setup.exe
File created	C:\Program Files (x86)\Rising\RAV\Regguide\imags\bt-40.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\VIRLIBBK\VIRLIBBK.xml	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\skin2\images\pagefix.png	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVUI\UI\pages\1252\scanobj.htm	setup.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSENGINE\ScanExec.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVGUIDE\Regguide\imags\bt-433.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\skins\skin1\images\ieprt2.png	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\UI\pages\1252\chmpge.htm	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\RsVirIns.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Regguide\Free0950.htm	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\popwndexe.exe = "11000"	popwndexe.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt.1\ = "MenuShlExt Class"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\RisingRavExt	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A3A6FD2-1667-43D2-800E-569235C32F09}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B041A79B-78C4-48CC-803E-0835D57069AE}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt.1\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EAF0EC2-8267-47CC-8F14-367146C4AD0E}\1.0\FLAGS	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83B07658-5A33-47D9-AFC7-EB3A79BE190F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20B37507-6072-4BE3-A8DA-22C040BB590F}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5EC7D9A-FFEA-48C9-AF3F-3AD1564F1D29}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\InprocServer32\ = "C:\\Windows\\SysWow64\\ravext.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\RisingRavExt\ = "{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\RisingRavExt	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83B07658-5A33-47D9-AFC7-EB3A79BE190F}\ = "IMenuShlExt"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B041A79B-78C4-48CC-803E-0835D57069AE}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33AEEACA-19F6-47E5-9CDE-6C0DCCD410F1}\TypeLib\ = "{4A3A6FD2-1667-43D2-800E-569235C32F09}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33AEEACA-19F6-47E5-9CDE-6C0DCCD410F1}\NumMethods	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\RisingRavExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcDll = "1700647640"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EAF0EC2-8267-47CC-8F14-367146C4AD0E}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20B37507-6072-4BE3-A8DA-22C040BB590F}\ProgID\ = "RsOLScan.OutlookAddin.1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5EC7D9A-FFEA-48C9-AF3F-3AD1564F1D29}\Programmable	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33AEEACA-19F6-47E5-9CDE-6C0DCCD410F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\RisingRavExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EAF0EC2-8267-47CC-8F14-367146C4AD0E}\1.0\0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EAF0EC2-8267-47CC-8F14-367146C4AD0E}\1.0\HELPDIR\ = "C:\\Windows\\system32"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83B07658-5A33-47D9-AFC7-EB3A79BE190F}\ = "IMenuShlExt"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83B07658-5A33-47D9-AFC7-EB3A79BE190F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20B37507-6072-4BE3-A8DA-22C040BB590F}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5EC7D9A-FFEA-48C9-AF3F-3AD1564F1D29}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33AEEACA-19F6-47E5-9CDE-6C0DCCD410F1}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt.1\CLSID\ = "{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\VersionIndependentProgID\ = "RavExt.MenuShlExt"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83B07658-5A33-47D9-AFC7-EB3A79BE190F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83B07658-5A33-47D9-AFC7-EB3A79BE190F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20B37507-6072-4BE3-A8DA-22C040BB590F}\InprocServer32\ = "C:\\Program Files (x86)\\Rising\\RAV\\rsolscan.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RsOLScan.RsSettingPropPage\ = "RsSettingPropPage Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B041A79B-78C4-48CC-803E-0835D57069AE}\InProcServer32\ = "C:\\Program Files (x86)\\Rising\\RAV\\rsolscan.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt\CLSID\ = "{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EAF0EC2-8267-47CC-8F14-367146C4AD0E}\1.0\0\win64\ = "C:\\Windows\\system32\\RavExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcInfo = "1669025240"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EAF0EC2-8267-47CC-8F14-367146C4AD0E}\1.0\0\win32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5EC7D9A-FFEA-48C9-AF3F-3AD1564F1D29}\ = "RsSettingPropPage Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A3A6FD2-1667-43D2-800E-569235C32F09}\1.0\ = "RsOLScan 1.0 Type Library"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\RisingRavExt\ = "{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FDDFAABE-1F9E-4805-9335-390A546A1052}\ = "RsOLScan"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RsOLScan.OutlookAddin\CLSID\ = "{20B37507-6072-4BE3-A8DA-22C040BB590F}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A3A6FD2-1667-43D2-800E-569235C32F09}\1.0\0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A3A6FD2-1667-43D2-800E-569235C32F09}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Rising\\RAV\\"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt.1\ = "MenuShlExt Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt\CurVer\ = "RavExt.MenuShlExt.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\RisingRavExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\RisingRavExt\ = "{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A3A6FD2-1667-43D2-800E-569235C32F09}\1.0\0\win32\ = "C:\\Program Files (x86)\\Rising\\RAV\\rsolscan.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33AEEACA-19F6-47E5-9CDE-6C0DCCD410F1}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}\ = "MenuShlExt Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\RisingRavExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt.1	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RavExt.MenuShlExt\CurVer\ = "RavExt.MenuShlExt.1"	setup.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
276	1103948b.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
964	setup.exe
964	setup.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1740	popwndexe.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
964	setup.exe
964	setup.exe
964	setup.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
Token: SeDebugPrivilege	964	setup.exe
Token: SeBackupPrivilege	1596	RsMgrSvc.exe
Token: SeDebugPrivilege	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 276	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	31
PID 1508 wrote to memory of 276	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	31
PID 1508 wrote to memory of 276	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	31
PID 1508 wrote to memory of 276	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	31
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1056	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	28
PID 1508 wrote to memory of 1464	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	29
PID 1508 wrote to memory of 276	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	31
PID 1508 wrote to memory of 276	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	31
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1056	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	28
PID 276 wrote to memory of 1604	276	1103948b.exe	33
PID 276 wrote to memory of 1604	276	1103948b.exe	33
PID 276 wrote to memory of 1604	276	1103948b.exe	33
PID 276 wrote to memory of 1604	276	1103948b.exe	33
PID 276 wrote to memory of 964	276	1103948b.exe	34
PID 276 wrote to memory of 964	276	1103948b.exe	34
PID 276 wrote to memory of 964	276	1103948b.exe	34
PID 276 wrote to memory of 964	276	1103948b.exe	34
PID 276 wrote to memory of 964	276	1103948b.exe	34
PID 276 wrote to memory of 964	276	1103948b.exe	34
PID 276 wrote to memory of 964	276	1103948b.exe	34
PID 964 wrote to memory of 532	964	setup.exe	35
PID 964 wrote to memory of 532	964	setup.exe	35
PID 964 wrote to memory of 532	964	setup.exe	35
PID 964 wrote to memory of 532	964	setup.exe	35
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1056	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	28
PID 1508 wrote to memory of 964	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	34
PID 1508 wrote to memory of 964	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	34
PID 1508 wrote to memory of 1120	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	18
PID 1508 wrote to memory of 1180	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	17
PID 1508 wrote to memory of 1232	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	10
PID 1508 wrote to memory of 1056	1508	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe	28
PID 964 wrote to memory of 1740	964	setup.exe	39
PID 964 wrote to memory of 1740	964	setup.exe	39
PID 964 wrote to memory of 1740	964	setup.exe	39

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe
  "C:\Users\Admin\AppData\Local\Temp\0fb4982a08f884109e39677dbb56b7264e9414b4e355dac6ffc3ceffaec8e433.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops autorun.inf file
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1508
- - C:\Users\Admin\AppData\Local\Temp\1103948b.exe
    C:\Users\Admin\AppData\Local\Temp\1103948b.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Users\Admin\AppData\Local\Temp\RavDown\Rising.dat
      "C:\Users\Admin\AppData\Local\Temp\RavDown\Rising.dat" -eo="C:\Users\Admin\AppData\Local\Temp\RAVTmp" /silence
      4⤵
      Executes dropped EXE
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\RAVTmp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RAVTmp\setup.exe" /S/RSDOWN
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Uses Session Manager for persistence
      Loads dropped DLL
      Adds Run key to start application
      Drops desktop.ini file(s)
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\RAVTmp\spanup\CheckOld.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RAVTmp\spanup\CheckOld.exe" /subkey=rav /SILENCE
        5⤵
        Executes dropped EXE
        
        PID:532
    - - C:\Users\Admin\AppData\Local\Temp\RAVTmp\langcfg\LangSel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RAVTmp\langcfg\LangSel.exe" /install /936 /950 /1252 /SILENCE
        5⤵
        Executes dropped EXE
        
        PID:1620
    - - C:\Program Files (x86)\Rising\RSD\popwndexe.exe
        
        "C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        
        PID:1740
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s RavExt64.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:1244
    - - C:\Program Files (x86)\Rising\RAV\RavMonD.exe
        
        "C:\Program Files (x86)\Rising\RAV\RavMonD.exe" -srv setup /SLIENCE
        5⤵
        Executes dropped EXE
        
        PID:1924

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1464

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1940

C:\Program Files (x86)\Rising\RAV\RavMonD.exe
"C:\Program Files (x86)\Rising\RAV\RavMonD.exe"
1⤵
- Executes dropped EXE
PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry